NAC 4.8 web agent with WSUS checking

Hi,
In some cases we would like to use the NAC 4.8 Web agent to check the WindowsUpdate related things.
We have a managed WSUS server, the ckeck working well with native win32 clients, but when we try connect with web agent,
the report show the following:
Information:
Failed to find Windows updates
Description:
Missing windows updates: 0
At the Windowsupdate.log file there is NOTHING about it, nor connecting, or any related.
Tried with the activex and Java client, the result is same. Also tried to catch some ip packets with Wireshark going to wsus server, but there is active connection.
Is this a bug, or the web agent is not WIndowsUpdate check compatible?
Thanks
Attila

Hi Eduardo,
We can check all the requirement rules, but notes,
this check is works well with native win agents, so I assume the CAM Requirements and Rules side is ok.
Pls. confirm, there is no matter how I'd like to check win patches (via web or with client) at Checks/Rules/Roles/Requirements config.
Attila

Similar Messages

NAC - Using ActiveX web agent with low level user

Hi:
I have NAC installed in-band and running. We have a group of test taker with user rights to the PC. The ActiveX web agent will not load and the Java agent does not start.
Any suggestion o dealing with some low secuirty issue and the browser.
Thanks
Dan

Hi Eduardo,
We can check all the requirement rules, but notes,
this check is works well with native win agents, so I assume the CAM Requirements and Rules side is ok.
Pls. confirm, there is no matter how I'd like to check win patches (via web or with client) at Checks/Rules/Roles/Requirements config.
Attila

Cisco NAC web agent failure

Is there a list somewhere that shows what the status's mean? I have a few users getting this error, while others are working fine -
Failed to download Cisco NAC Web Agent ( status = -2 ) !
Thanks!

For the web agent, there are three error states
-1 means that it was unable to launch the control at all,
-2 means it failed to download the agent executable,
-3 means there was an error running the web agent
Are you using the Java or ActiveX version of the web agent? Definitely check the browser settings for both and make sure that it's either allowing or prompting the user for the applets. If you're using the ActiveX version, you could try forcing the Java version, as most users seem to have more lenient browser settings by default for it.

ISE - Can't install Web Agent

Dear guys,
I have problem in my lab case like sequence below:
A guest access into internal network, then will be redirect to Guest Portal.
A guest log in successfully using credential (was created by sponsor account)
Then, "Client Provisioning" process starts. Base on Client Provisioning policy with OS: Windows 8, guest session will be apply on Web Agent.
Then Web Agent install and check status process starts. But, in this phase. I got a error like this:
In Chrome & FF browser: "You will not be allowed to access the network due to internal error. please contact your administrator"
In IE browser:
"You will not be allowed to access the network due to internal error. please contact your administrator"
"Your login session failed! (status = 36) You will have limited network connectivity. Please try disconnecting and reconnecting to the network to start a new connection (or) contact your system administrator if the problem persists"
In addition:
I imported certificated (was signed by AD Root CA) into Local Certificates.
I imported AD Root certificated into Certificate Store.
I will be grateful for any help you can provide.
Have a nice day !

Web agent should handle cert. revocation dialog box similar to Win agent
CSCsl40626
Description
Symptom:
Revocation failed dialog box keeps popping up on client machine despite of clicking "Yes" button
Conditions:
This issue is seen on the client machine performing login either using Windows agent or NAC web agent. The issue happens when the Clean Access Server (CAS) certificate root CA is not listed in the trusted store on the client machine. The issue is known to be reproducible on all flavors of Win XP & Win Vista using Windows or NAC web agent
Workaround:
Try selecting Yes. If this does not work you can turn off the security certificates revocation check by changing the options in Internet Explorer IE.
Use the following procedure to change the option in IE:
1. Launch IE
2. From the tool bar, select Tools then Internet Options
3. Select the Advanced tab
4. In the Security section, un-check the option "Check for server certificate revocation"
5. Click on the Apply button
6. Click on the OK button
7. Close IE
8. Try the web login again
Product:
Cisco NAC Appliance (Clean Access)
Known Affected Releases:
(1)
4.1(3.6)

Problem Web Agent IIS5.0 in win2k

Hi All,
I have installed Web Agent for IIS5.0 in a win2k system.
I have edited the amagent.properties file so that it enforces polices from the Identity server.
When i try to access a web resource protected by the web agent , it dosen't seem to work on the basis of policies mentioned in the identity server.
Also the log gives out an error like this.....
2003-11-10 13:56:22.661 Error 1532:00C62840 PolicyEngine: am_policy_evaluate: InternalException in Service::getPolicyResult with error message:Policy not found for resource: http://xyz.example.com:58080/ssoapptest and code:7
2003-11-10 13:56:22.671 Error 1532:00C62840 PolicyEngine: am_policy_evaluate: InternalException in Service::getPolicyResult with error message:Policy not found for resource: http://xyz.example.com:58080/ssoapptest/ and code:7
Help me out in solving this problem.
Also kindly explain how SSO functions here in accessing the application.

Hi Sriram
I haven't such any documentation for sun one web server 6.1. Actually i followed the SM Web agent installation doc for iPlanet web server.
Morover i tried to configure Sun one web server 6.1 with SM web agent also but got the same error as with web server 7.0.
I have seen in this forum only that we can configure SM web agent with Sun one web server 6.1 But any special step needed or version incompatibility that i want to check.
For your referrence u can check this forum which states that SM web agent can configure with web server 6.1
http://forum.java.sun.com/thread.jspa?threadID=5109389

Web Agent in 10g OLAP??

Hi all,
I was wondering whether the Web Agent component for 10g OLAP is available. From what I can see on the Oracle sites, there is only an install for 9.2.0.4.
Can some one please confirm, as I am interested in upgrading to the New version, to take a look at the newer features available with the AW, however I require Web Agent.
Regards,
Imran

Hi Imran,
If you want to run Oracle OLAP Web Agent with the Oracle 10g database, you should install OLAP Web Agent 9.2.1 base version - patch 3467263 on Metalink, and then install Web Agent 9.2.1 patch 1 - patch 3941853 on Metalink. Patch 1 is required for 10g compatability.
I will try and ensure that it gets correctly listed for the 10g database.
We will soon release 9.2.1 Patch 2 with updated Java certificates.
Regards,
Aneel Shenker
Senior Product Manager
Oracle Business Intelligence

Web services with XFire.

Hi,
I am completely new to web service with XFire topic and want to work on any sample application to get some idea on web services with XFire.

check your Tomcat documentation and try to test with relative path
Edited by: RezaRavasizadeh on Sep 2, 2008 5:40 PM

Use NAC Web Agent login with Ipad

Hello Guys,
I'm using NAC 4.8, and I'd like to login using NAC Web Agent on Ipad.
When I'm trying to do that, I'm receiving a message on Ipad that I need to install Java Plug-In, but there is no JavaPlug-in available for Ipad.
Does anyone know if there is any aditional configuration that I have to do on NAC Manager to be able to access the network using NAC Web Login on Ipad ?
Best Regards

Hi Luciano,
Unfortunately, the NAC Web Agent and the persistant Agent are not supported for the iPad operating system. (It is called iOS). The following table documents this fact under footnote 3:
http://www.cisco.com/en/US/docs/security/nac/appliance/support_guide/agntsprt.html#wp125630
Only normal Web Login with Safari browser is enabled.
Hope this helps.
-Shrikant
P.S.: Please mark this question as answered if it has been resolved. Do rate helpful posts. Thanks.

Cisco NAC web agent Network Security Policy

I have a computer with an installed McAfee Antivirus that us up to date. However, each time try to access one of my client's server via VPN, I successfully connect to VPN using Cisco Anyconnnect but whenever I try to download the web agent and the device security check is being run, I get the feedback "Host is not compliant with network security policy". It also tells me a Remediation description of "please update your antivirus". (see attached screenshot)
Please note that I already have my McAfee antivirus updated and I have done everything to keep my computer in good shape in terms of security.
What is the possible cause for this?

That means the CAM hasn't received an SNMP trap for that MAC address. Double-check that the WLC is set up to send traps to the CAM: http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/47/cam/m_woob.html#wp1290626
You can see if the CAM's received a trap for a specific MAC by looking under OOB Management > Devices > Discovered Clients.

Cisco NAC Web Agent + Windows 8

Hello,
I´m implementing a Cisco ISE 1.2 and I am having troubles with NAC Web Agent and Windows 8 compatibility.
All time that I try install NAC Web Agent in Windows 8, I get the message "Agent User Operating System is Not Supported".
Follow are some informations about my Environment:
ISE 1.2 Patch 3
OS: Windows 8 Enterprise
IE: 10 (In Desktop Mode w and w/o Compatibility View)
NAC Web Agent: 4.9.0.1007
Could you help me ?
Best Regards,
Daniel Stefani

Hi Charles,
I can download all this files, but I can’t import it in ISE Resourses.
NAC Agent MST files
nacagentsetup-mst-4.9.3.9.zip
NAC Agent MSI Installation file
nacagentsetup-win-4.9.3.9.msi
NAC Agent Installation Package
nacagentsetup-win-4.9.3.9.tar.gz
Mac Agent Installation Package for MacOSX
CCAAgentMacOSX-4.9.3.803.tar.gz
NAC Agent MST files
nacagentsetup-mst-4.9.3.5.zip
NAC Agent MSI Installation file
nacagentsetup-win-4.9.3.5.msi
NAC Agent Installation Package
nacagentsetup-win-4.9.3.5.tar.gz
In this link that you sent me doesn’t have options to Cisco NAC Web Agent.
But in the follow yes…
http://software.cisco.com/download/release.html?mdfid=283801620&flowid=26081&softwareid=283802505&release=1.2&relind=AVAILABLE&rellifecycle=&reltype=latest
Best Regards,
Daniel Stefani

NAC web agent question

Hi,
I need to know when can i use the NAC web agent??? is it used for guests or visitors only????
If i used NAC web agent for guests , can i perform posture assessment for the guest users ( i mean check windows update , AV/AS or certain services)?? or network scanning will be only applied to the guests who are using NAC web agent????
i read the userguide of 4.7.1 of CAM and CAS but i have some conflicts regarding the above topic , so please i need your help.
Mohamed

Mohamed,
You can use it for any kind of users (guest/regular) and can do posture assessment, but no remediation. Remediation requires the full agent. The other limitation is that the web agent is only valid on Windows machines and cannot run on Mac/Linux etc.
HTH,
Faisal

Protecting a REST web service with Policy Agent

I have deployed a REST web service in Glassfish using Jersey Annotations. A UI in the same Glassfish instance is protected by a policy agent that forces users through a login page. I would like to protect the REST web service with BASIC Authentication using the same policy agent. Is this possible? Is there supporting documentation?

Hi Daniel,
When you publish a message through Rest, hope your Restful service will receive/process the posted message?
So
YourBizTalk -->(Post Message to)-->RestFulService
From the error message, "the published message could not be routed because no subscribers were found.", it seems like the this Restful service is a
wrapper (or service interface) for BizTalk at client end( where message has been posted thru Rest) and actual posted message is “processed” by BizTalk and the error "" is from BizTalk "after" Rest. This message says the message you posted
through rest is not found subscription at their end.
So
YourBizTalk -->(Post Message to)-->RestFulService -->Clients'BizTalk.
Here problem is at Clients'BizTalk as shown where the posted message to their BizTalk is not processed because no subscription has been found.
If this answers your question please mark it accordingly. If this post is helpful, please vote as helpful by clicking the upward arrow mark next to my reply.

Apache Web Agent problem (web agent 2.0, Opensso 8.0) with IHS/WAS 6.1

I installed a apache web agent 2.0 and opensso 8.0 on the same windows server. The web agent is running over IHS server. Opensso is running overs WAS 6.1
While attempting to access an application, after succesful authentification, i got on the web browser a 403 error.
Can someone help me?
You can find below, the error message on the browser, and an extract of agent log file.
Thanks
Regards
Gigi62
Error message on the web browser:
Forbidden
You don't have permission to access /AppliTestOpensso1 on this server.
IBM_HTTP_Server Server at aaaa.agent.com Port 80
Extract of the agent log file:
2009-12-22 09:31:44.647MaxDebug 5356:d11e88 AM_POLICY_SERVICE: am_policy_compare_urls(): compare usePatterns=false returned 3
2009-12-22 09:31:44.647MaxDebug 5356:d11e88 all: is_url_enforced(): URL http://aaaa.agent.com:80/AppliTestOpensso1 is enforced.
2009-12-22 09:31:44.647 Debug 5356:d11e88 all: am_web_get_parameter_value(): Param Name = iPlanetDirectoryPro, & Param Value = NULL, status not found
2009-12-22 09:31:44.647 Debug 5356:d11e88 all: am_web_is_access_allowed()(http://aaaa.agent.com:80/AppliTestOpensso1,GET): no sso token, setting status to invalid session.
2009-12-22 09:31:44.647 Info 5356:d11e88 all: am_web_is_access_allowed()(http://aaaa.agent.com:80/AppliTestOpensso1, GET) returning status: invalid session.
2009-12-22 09:31:44.647 Info 5356:d11e88 all: process_request(): Access check for URL http://aaaa.agent.com:80/AppliTestOpensso1 returned invalid session.
2009-12-22 09:31:44.647MaxDebug 5356:d11e88 all: am_web_get_url_to_redirect: goto URL is http://aaaa.agent.com:80/AppliTestOpensso1
2009-12-22 09:31:44.647MaxDebug 5356:d11e88 all: find_active_login_server(): Trying server: http://aaaa.agent.com:9080/opensso/UI/Login
2009-12-22 09:31:44.647 Debug 5356:d11e88 all: is_server_alive(): Connection timeout set to 2
2009-12-22 09:31:44.709 Debug 5356:d11e88 all: process_access_redirect(): get redirect url returned AM_SUCCESS, redirect url [http://aaaa.agent.com:9080/opensso/UI/Login?goto=http%3A%2F%2Faaaa.agent.com%3A80%2FAppliTestOpensso1].
2009-12-22 09:31:44.709 Debug 5356:d11e88 all: process_access_redirect(): returning web result AM_WEB_RESULT_REDIRECT.
2009-12-22 09:31:44.709 Debug 5356:d11e88 all: process_request(): returning web result AM_WEB_RESULT_REDIRECT, data [http://aaaa.agent.com:9080/opensso/UI/Login?goto=http%3A%2F%2Faaaa.agent.com%3A80%2FAppliTestOpensso1]
2009-12-22 09:31:44.709 Debug 5356:d11e88 all: am_web_process_request(): Rendering web result AM_WEB_RESULT_REDIRECT
2009-12-22 09:31:44.709 Debug 5356:d11e88 all: am_web_process_request(): render result function returned AM_SUCCESS.
2009-12-22 09:31:44.709MaxDebug 5356:d11e88 all: get_request_url(): Host: aaaa.agent.com
2009-12-22 09:31:44.709MaxDebug 5356:d11e88 all: get_request_url(): Port is 80.
2009-12-22 09:31:44.709 Debug 5356:d11e88 all: get_request_url(): Returning request URL http://aaaa.agent.com:80/AppliTestOpensso1.
2009-12-22 09:31:44.709 Warning 5356:d11e88 all: get_method_num(): Apache request method number did not match method string. Setting method number to match method string GET.
2009-12-22 09:31:44.709MaxDebug 5356:d11e88 all: am_web_is_notification(), http://aaaa.agent.com:80/AppliTestOpensso1 is not notification url http://aaaa.agent.com:80/UpdateAgentCacheServlet?shortcircuit=false.
2009-12-22 09:31:44.709MaxDebug 5356:d11e88 all: am_web_is_access_allowed(): Processing url http://aaaa.agent.com:80/AppliTestOpensso1.
2009-12-22 09:31:44.709MaxDebug 5356:d11e88 all: FqdnHandler::isValidFqdnResource() Resource => http://aaaa.agent.com:80/AppliTestOpensso1, is valid => true
2009-12-22 09:31:44.709 Debug 5356:d11e88 all: is_url_enforced(): client_ip 10.245.197.145 not found in client ip not enforced list
2009-12-22 09:31:44.709MaxDebug 5356:d11e88 AM_POLICY_SERVICE: am_policy_compare_urls(): compare usePatterns=true returned 3
2009-12-22 09:31:44.709 Debug 5356:d11e88 all: in_not_enforced_list: enforcing access control for http://aaaa.agent.com:80/AppliTestOpensso1
2009-12-22 09:31:44.709 Debug 5356:d11e88 all: am_web_is_logout_url(http://aaaa.agent.com:80/AppliTestOpensso1): normalized URL http://aaaa.agent.com:80/AppliTestOpensso1.

Hi gimbal2 ,
thanks for your prompt response.
I deleted jsf-facelets.jar from the lib.
Also I removed      <context-param>
          <param-name>org.apache.myfaces.trinidad.ALTERNATE_VIEW_HANDLER</param-name>
          <param-value>org.apache.myfaces.trinidadinternal.facelets.TrinidadFaceletViewHandler</param-value>
     </context-param>
     <context-param>
          <param-name>org.apache.myfaces.trinidad.FACELETS_VIEW_MAPPINGS</param-name>
          <param-value>*.xhtml</param-value>
     </context-param>Now that error has gone .But I am still not able to switch between the tabs for .xhtml page but it is working fine for .jsp page.
For .xhtml page , on clicking on the tab, console is showing something like below
Aug 17, 2010 9:20:49 PM org.apache.myfaces.trinidad.component.UIXShowDetail broadcast
WARNING: Event org.apache.myfaces.trinidad.event.DisclosureEvent[phaseId=INVOKE_APPLICATION(5),component=CoreShowDetailItem[UINodeFacesBean, id=j_id957384125_39108532],expanded=true] was delivered to a showDetail already in that disclosure state.

Integrating WebLogic Server with CA SiteMinder Web Agent R6

Hi I have searched on the topic of integrating WebLogic Server with the CA SiteMinder Web Agent R6 to provide single sign on services, and have been unable to find anything. Does anyone have any experience with this that could provide some tips, or could direct me to some documentation?

It definitely can work. We have done the same thing in several installations. The question is "How secure does it need to be?" You will be using SM to do authentication. You will configure SSO to trust the SM header variable. If you really want to be secure you need to configure your boxes so that the http server on you SUSE box (for Portal) can only be accessed from the Reverse Proxy. If another machine can access it someone could spoof the header variable and log in as anyone they want.
Hope this is helpful.
Anton

I started setting up a web page with iWeb. Auto play box is checked, but music will not play when page is opened.

I started setting up a web page with IWeb.
Several proplems so far:
1) Auto Play box checked for music, but music does not start when page is opened.
2) Can't get Quicktime "start/stop" slide to start and finish a section within a long piece of music (classical for example). How does one work the slide bar to do this?

Yes the audio file plays on the iWeb page when I click the play button. I even made sure it played both without the “little boxes” that surround the icon (don’t know the technical name for those), and when I click the music icon without the little boxes.
I did note that the iTunes window that appears when I open the Inspector is not highlighted until I click the music icon and those little boxes appear. Then the Start/Stop, Auto Play, Loop, and Show Movie Controller are highlighted — and work properly.
One other thing. I see that the iWeb icon I am working from says “Domain copy.sites2.” Does that have a bearing on anything?

NAC 4.8 web agent with WSUS checking

Similar Messages

Maybe you are looking for